NSE7 Practice Test 31 — 15 Questions

Question 1

A FortiGate has two WAN interfaces configured as SD-WAN members. The administrator wants traffic to specific destination IP addresses to use a particular member. Which SD-WAN configuration object should be used to achieve this?

Accepted Answer

SD-WAN rule. SD-WAN rules allow matching traffic based on criteria such as source/destination IP, and then forward it to a specific SD-WAN member or strategy.

Answer

Route map

Answer

Prefix list

Answer

Performance SLA

Question 2

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

Accepted Answer

There is no interface assigned to area 0. To be an ABR, the FortiGate must have interfaces in area 0 (backbone) and at least one other area. If no interface is in area 0, it cannot be an ABR.

Answer

The router-id is not configured

Answer

The OSPF process is not enabled

Answer

The network type is set to point-to-point

Question 3

A FortiGate is configured with SD-WAN and uses performance SLA to monitor link quality. The administrator sets the SLA threshold to jitter < 30ms. If a link has average jitter of 35ms, what is the status of that link in the SD-WAN health check?

Accepted Answer

Degraded. When the measured jitter exceeds the threshold, the link is considered 'degraded' (or 'failed' depending on configuration) for that SLA. In SD-WAN, the member may still be used but with lower preference.

Answer

Dead

Answer

Unavailable

Answer

Alive

Question 4

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

Accepted Answer

The route map is not applied to the redistribution configuration. When redistributing into OSPF, the metric type can be set to type 1 or type 2. Type 2 (default) does not add internal cost, but the metric set in the route map should still apply. However, if the route map is not applied correctly or OSPF's default metric (20 for redistributed routes) overrides, the route map might be misconfigured. Option D is correct: the route map might not be applied to redistribution.

Answer

The route map is applied to the wrong direction

Answer

OSPF does not allow metric setting via route maps

Answer

The metric type is set to type 1

Question 5

A FortiGate is configured with OSPF and multiple areas. The administrator wants to prevent type 3 LSAs from entering a specific area, while still allowing inter-area routing. Which TWO configurations can achieve this?

Accepted Answer

Configure the area as a stub area. Type 3 LSAs are summary LSAs. To block them, you can configure the area as a stub area (which blocks type 5 as well) or use an area filter list to filter specific prefixes.

Answer

Configure the area as an NSSA

Answer

Set the OSPF network type to point-to-multipoint

Question 6

An administrator needs to integrate a FortiSwitch with a FortiGate for LAN edge management. The FortiSwitch will be used to provide access ports for end users. Which THREE configuration steps are required on the FortiGate?

Accepted Answer

Create a port profile that defines VLAN and security settings for the access ports. The FortiGate acts as the controller for managed FortiSwitches. Key steps include enabling CAPWAP, creating a port profile, and authorizing the switch.

Answer

Configure a DHCP server on the FortiGate to assign IP addresses to FortiSwitch management

Answer

Enable STP on the FortiGate interface

Question 7

An administrator configures a performance SLA for SD-WAN health checks. The SLA uses a ping probe to 8.8.8.8 every 2 seconds with a latency threshold of 150 ms and jitter threshold of 20 ms. After some time, the SD-WAN rule still shows the member as 'dead'. Which command should the administrator use to verify the probe results?

Accepted Answer

diagnose sys sdwan health-check. The 'diagnose npu np6 sdf-wan health-check' command shows detailed probe statistics per member, including latency, jitter, and packet loss, helping to identify why the SLA is failing.

Answer

show system sdwan health-check

Answer

diagnose sys session list

Answer

execute ping-options source 8.8.8.8

Question 8

A network administrator needs to configure SD-WAN on a FortiGate to distribute traffic across two WAN links based on session count. Which load balancing algorithm should be selected in the SD-WAN rule?

Accepted Answer

Sessions. The 'sessions' algorithm distributes new sessions across members proportionally to the number of active sessions, achieving session-based load balancing.

Answer

Volume

Answer

Lowest-cost

Answer

Spillover

Question 9

A FortiGate with two WAN interfaces configured in an SD-WAN setup uses the 'lowest-cost' load balancing algorithm. The performance SLA monitors latency and jitter. If wan1 has a cost of 10 and wan2 has a cost of 20, but wan1 is experiencing 50% packet loss, what will happen to traffic?

Accepted Answer

Traffic is sent to wan2 because wan1 is considered dead. The 'lowest-cost' algorithm selects the member with the lowest cost. However, if a member fails the performance SLA (e.g., high packet loss), it is considered 'dead' and will not be used, even if its cost is lower. Traffic will then be sent to the next lowest-cost member that is alive.

Answer

Traffic is distributed equally between both links

Answer

Traffic is dropped until wan1 recovers

Answer

Traffic continues using wan1 because cost is lower

Question 10

A network administrator configures an SD-WAN zone with two members (port1 and port2) and sets the load balancing algorithm to 'spillover'. The spillover threshold is set to 100 Mbps on port1. If traffic reaches 120 Mbps on port1, what happens to new sessions?

Accepted Answer

New sessions are sent to port2 until port1 drops below the threshold. Spillover algorithm sends traffic to the preferred member (lowest cost or first in order) until its bandwidth exceeds the threshold. When the threshold is exceeded, new sessions are sent to the next available member. Port2 will handle new sessions until port1 drops below the threshold.

Answer

All traffic is dropped because the threshold exceeded

Answer

Port1 continues to receive all new sessions but packets are queued

Answer

New sessions are distributed equally between port1 and port2

Question 11

A FortiGate has two equal-cost paths to a destination network. ECMP is enabled. The administrator notices that all traffic uses the first path. What is the most likely cause?

Accepted Answer

ECMP is configured to use 'source-dest-ip' hash and all sessions are from same source to same destination. ECMP distributes session flows, but if all traffic is using one path, it might be due to a session-based hash that results in the same path for all sessions, or the ECMP load balancing may be set to 'source-dest-ip' and the traffic is from one source to one destination. More likely, the ECMP load balancing mode is set to 'usage' or there is a policy-based route overriding.

Answer

ECMP is configured with 'spillover' mode

Answer

The second path is administratively down

Answer

The route metric is not equal

Question 12

Which load balancing algorithm in SD-WAN sends new sessions to the member interface with the least number of active sessions?

Accepted Answer

Sessions

Answer

Volume

Answer

Spillover

Answer

Source-dest IP

Question 13

What is the purpose of BFD on a FortiGate?

Accepted Answer

To provide fast detection of link failures.

Answer

To load balance traffic across multiple paths.

Answer

To authenticate OSPF neighbors.

Answer

To encrypt traffic between two FortiGates.

Question 14

A FortiGate in a multi-area OSPF network is not learning routes from area 1. Which THREE items could be causing this?

Accepted Answer

There is a firewall policy blocking OSPF traffic between areas.

Answer

The ABR is not configured with 'set type' for area 1.

Answer

The 'set redistribute' option is missing on the ABR.

Question 15

An administrator has configured OSPF on a FortiGate with multiple areas. They want to ensure that routes from area 0 are redistributed into area 1, but they notice that routes from area 1 are not appearing in area 0. What is the most likely configuration issue?

Accepted Answer

The ABR has 'area 1 stub' configured, preventing LSA type 5 redistribution

Answer

There is a firewall policy blocking OSPF packets

Answer

The redistribution is done with a route map that is not permitting the routes

Answer

The ABR is not configured with 'area 0' and 'area 1' on the same router